Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2025-02-25
CVE-2024-13791 - Bit Assist Plugin
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
Bit Assist
CVE-2024-13791
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2024-13735 - Hurrytimer Plugin
The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.11.2 due to insufficient input sanitization and output escaping of a campaign name. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Hurrytimer
CVE-2024-13735
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2024-9601 - Qubely Plugin
The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Qubely
CVE-2024-9601
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2024-13692 - Return Refund And Exchange For Woocommerce Plugin
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.4.5 via several functions due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite linked refund image attachments, overwrite refund request message, overwrite order messages, and read order messages of other users.
PLUGIN
Return Refund And Exchange For Woocommerce
CVE-2024-13692
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-7052 - Forminator Forms Plugin
The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Forminator Forms
CVE-2024-7052
Risk Score
Threat Entry
Updated 2025-02-25
CVE-2024-13641 - Return Refund And Exchange For Woocommerce Plugin
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/attachment directory which can contain file attachments for order refunds.
PLUGIN
Return Refund And Exchange For Woocommerce
CVE-2024-13641
Risk Score
Threat Entry
Updated 2025-05-14
CVE-2024-13493 - Sensly Online Presence Plugin
The Sensly Online Presence WordPress plugin through 0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Sensly Online Presence
CVE-2024-13493
Risk Score
Threat Entry
Updated 2025-02-13
CVE-2024-13182 - Wp Directorybox Manager Plugin
The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator.
PLUGIN
Wp Directorybox Manager
CVE-2024-13182
Risk Score
Threat Entry
Updated 2025-02-18
CVE-2024-13606 - Js Help Desk Plugin
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'jssupportticketdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attachments included in support tickets.
PLUGIN
Js Help Desk
CVE-2024-13606
Risk Score
Threat Entry
Updated 2025-02-18
CVE-2024-13867 - Listivo Plugin
The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 2.3.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Listivo
CVE-2024-13867
Risk Score
Threat Entry
Updated 2025-02-18
CVE-2024-13639 - Read More Accordion Plugin
The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteData() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary 'read more' posts.
PLUGIN
Read More Accordion
CVE-2024-13639
Risk Score
Threat Entry
Updated 2025-02-24
CVE-2025-0661 - Dethemekit For Elementor Plugin
The DethemeKit For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, draft, or scheduled posts that they should not have access to by duplicating the post.
PLUGIN
Dethemekit For Elementor
CVE-2025-0661
Risk Score
Threat Entry
Updated 2025-02-24
CVE-2024-13346 - Avada Plugin
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.11.13. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
Avada
CVE-2024-13346
Risk Score
Threat Entry
Updated 2025-04-14
CVE-2024-13345 - Avada Builder Plugin
The Avada Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.11.13. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
Avada Builder
CVE-2024-13345
Risk Score
Threat Entry
Updated 2025-05-26
CVE-2025-0692 - Simple Video Management System Plugin
The Simple Video Management System WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Simple Video Management System
CVE-2025-0692
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2024-13125 - Everest Forms Plugin
The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Everest Forms
CVE-2024-13125
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2024-13121 - Restrict Content Plugin
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Restrict Content
CVE-2024-13121
Risk Score
Threat Entry
Updated 2025-05-23
CVE-2024-12586 - Chalet Montagne Com Tools Plugin
The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Chalet Montagne Com Tools
CVE-2024-12586
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2024-13120 - Restrict Content Plugin
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Restrict Content
CVE-2024-13120
Risk Score
Threat Entry
Updated 2025-05-21
CVE-2024-13119 - Restrict Content Plugin
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Restrict Content
CVE-2024-13119
Risk Score